Project

General

Profile

Actions

Feature #3306

closed

Support AF_XDP capture method

Added by Eric Leblond over 4 years ago. Updated over 1 year ago.

Status:
Closed
Priority:
Normal
Target version:
Effort:
medium
Difficulty:
high
Label:

Description

A new capture method has been recently introduced in Linux. Named AF_XDP, it allows to capture the traffic with a kernel bypass. This limit the cost of the capture in term of CPU cycle.


Related issues 2 (2 open0 closed)

Related to Suricata - Task #3288: Suricon 2019 brainstormAssignedVictor JulienActions
Related to Suricata - Task #4097: Suricon 2020 brainstormAssignedVictor JulienActions
Actions #1

Updated by Eric Leblond over 4 years ago

Beginning of implementation using libbpf: https://github.com/regit/suricata/tree/af-xdp-v2

Actions #2

Updated by Eric Leblond over 4 years ago

  • Parent task set to #3288
Actions #3

Updated by Victor Julien over 4 years ago

  • Status changed from New to Assigned
  • Assignee set to Eric Leblond
  • Target version set to TBD

Set target to TBD as we are waiting for the kernel to provide us with timestamp support.

Actions #4

Updated by Victor Julien over 4 years ago

  • Parent task deleted (#3288)
Actions #5

Updated by Victor Julien over 4 years ago

  • Related to Task #3288: Suricon 2019 brainstorm added
Actions #6

Updated by Victor Julien over 3 years ago

  • Related to Task #4097: Suricon 2020 brainstorm added
Actions #7

Updated by Victor Julien over 2 years ago

  • Status changed from Assigned to In Progress
Actions #8

Updated by Eric Leblond over 1 year ago

AF_XDP functions in libbpf have been moved to xdp-tools (https://github.com/xdp-project/xdp-tools) which means we need to update the build system and use the new functions.

Actions #9

Updated by Victor Julien over 1 year ago

  • Status changed from In Progress to In Review
  • Assignee changed from Eric Leblond to Richard McConnell
  • Target version changed from TBD to 7.0.0-rc1
Actions #10

Updated by Victor Julien over 1 year ago

  • Status changed from In Review to Closed
Actions

Also available in: Atom PDF